Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

10,634 results · Feed

  • Medium 5.3
    CVE-2026-65487

    WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

    ThemeGoods Photography
  • Medium 5.3
    CVE-2026-65486

    WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

    Bastien Ho Event post
  • Medium 6.3
    CVE-2026-65484

    WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

    Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

    AnalogWP Style Kits
  • Medium 5.3
    CVE-2026-65485

    WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

    Daniel Iser Content Control
  • Medium 5.4
    CVE-2026-65479

    WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

    MVP Themes Reviewer
  • Medium 5.4
    CVE-2026-65478

    WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

    Cridio Studio ListingPro
  • Medium 5.3
    CVE-2026-65476

    WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

    uxper Civi
  • Medium 5.3
    CVE-2026-65472

    WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

    Kit Kit (formerly ConvertKit)
  • Medium 5.3
    CVE-2026-65469

    WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

    Strategy11 Team AWP Classifieds
  • Medium 5.3
    CVE-2026-65468

    WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

    Crocoblock. Jetimpex JetBooking
  • Medium 4.3
    CVE-2026-65457

    WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

    yoomoney ЮKassa для WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-65452

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 5.3
    CVE-2026-65453

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 4.3
    CVE-2026-61973

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 5.3
    CVE-2026-61972

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • High 7.5
    CVE-2026-61954

    WordPress PayU India plugin <= 3.8.9 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.

    PayU India PayU India
  • High 7.5
    CVE-2026-61943

    WordPress WPDM – Premium Packages plugin <= 6.2.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

    Shahjada WPDM – Premium Packages
  • High 7.5
    CVE-2026-59547

    WordPress Payment Gateway for PayPal on WooCommerce plugin <= 9.1.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

    Easy Payment Payment Gateway for PayPal on WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-59522

    WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

    wedevs WP ERP
  • Medium 6.5
    CVE-2026-57808

    WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability

    Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

    Saad Iqbal WP EasyPay
  • Medium 6.5
    CVE-2026-57717

    WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

    Knit Pay Knit Pay
  • Medium 6.3
    CVE-2026-57703

    WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

    sunshinephotocart Sunshine Photo Cart
  • Medium 6.5
    CVE-2026-57425

    WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

    WP Desk Autopay dla WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-27423

    WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

    Roland Barker Participants Database
  • High 7.1
    CVE-2026-57367

    WordPress WP Booking System plugin < 5.12.8.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

    WP Booking System . WP Booking System
  • Medium 5.3
    CVE-2026-27422

    WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

    bPlugins YT Player
  • Medium 5.3
    CVE-2026-27418

    WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

    Epsiloncool WP Fast Total Search
  • Medium 5.3
    CVE-2026-27399

    WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

    WebWizards MarketKing
  • Medium 5.4
    CVE-2026-27391

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in uListing <= 2.2.0 versions.

    stylemix uListing
  • Medium 4.3
    CVE-2026-27392

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Contributor Broken Access Control in uListing <= 2.2.0 versions.

    stylemix uListing
  • Medium 6.7
    CVE-2026-27377

    WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

    Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

    axiomthemes QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • Medium 5.3
    CVE-2026-27355

    WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

    Metaphor Creations Ditty
  • Medium 5.4
    CVE-2026-25427

    WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

    DigitalME eRoom
  • Medium 5.3
    CVE-2026-25466

    WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

    WPGMaps WP Go Maps
  • Medium 4.3
    CVE-2026-25424

    WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

    Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

    mediavine Mediavine Control Panel
  • Critical 9.8
    CVE-2026-15015 Public exploit Scanner template

    MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

    The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it …

    Cascadia Web Services MountDev AI MCP Connector for WordPress Web / CMS
  • Medium 5.3
    CVE-2026-15827

    GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints

    The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and …

    Ataur R GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor Web / CMS
  • Medium 6.8
    CVE-2026-59677

    Process Kill Attack Vector in killall() in seunshare

    A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10.

    SELinux Project selinux policycoreutils policycoreutils Debian Ubuntu
  • High 7.5
    CVE-2026-12082

    Praison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)

    The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 con…

    Web / CMS
  • High 7.7
    CVE-2026-13078 Public exploit

    Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges…

    MongoDB MongoDB Server mongodb Ubuntu